bx33661/oh-my-vul

omv-audit

Deep-audits a candidate finding from an Evidence.v1 file. Use when the user has an omv-find result they want to investigate further, wants to prove or disprove a vulnerability, needs to fill Evidence.v1 fields for omv-report, or invokes `/omv-audit`. Reads…

原文语言：多语言混合

omv-critic

Performs adversarial pre-submission review of an Evidence.v1 finding plus optional ThreatMap.v1 and Verification.v1 sidecars. Use before `/omv-report` when the user wants likely CNA rejection reasons, report argument quality review, a reject_risk rating, or a…

原文语言：英语

omv-dedup

Checks whether an Evidence.v1 finding is likely already disclosed. Use when the user asks to deduplicate a finding, check CNA duplicate risk, search NVD/GHSA/OSV/ecosystem advisory databases or public discussion (issues, PRs, commits, blogs), or invokes…

原文语言：英语

omv-disclose

Helps prepare responsible disclosure communications and timelines from an Evidence.v1 finding. Use when the user asks to contact a vendor, create initial/follow-up/deadline disclosure email templates, plan a 90-day timeline, record disclosure fields, or…

原文语言：英语

omv-find

Finds and ranks open-source packages worth auditing for passive CVE/VulDB research. Use when the user asks for vulnerability research targets, CVE hunting candidates, packages to audit, projects to fuzz, or `/omv-find`. Supports npm, Python, Go, Rust, Java,…

原文语言：英语

omv-radar

Variant-driven diffusion hunting for oh-my-vul. Use when the user has a confirmed or publicly disclosed vulnerability pattern and wants to find the same bug class in sibling packages, forks, or downstream consumers; also when they ask for watchlist…

原文语言：英语

omv-report

Generate a complete, ready-to-submit VulDB vulnerability report and CVE request. Covers all major package ecosystems: npm, pip, Go, Cargo (Rust), RubyGems, Maven, Gradle, NuGet, Composer (PHP), CocoaPods, Swift Package Manager, pub (Dart/Flutter), Hex…

原文语言：英语

omv-repro

Guides a researcher through local reproduction of a vulnerability finding. Use when the user has an omv-audit result with evidence.reproducer filled but evidence.observed_result still unknown, wants to confirm a finding by running it locally, or invokes…

原文语言：多语言混合

omv

oh-my-vul local-first vulnerability research project manager for Pi, Codex, and Claude Code. Shows workspace status, next actions, installed omv-* skills, registry info, and delegates .omv findings lifecycle commands. Use when the user invokes /skill:omv,…

原文语言：英语

using-omv

Bootstrap discipline for oh-my-vul research. Use at the start of any vulnerability research conversation, when the user asks to audit/find/report a package, dig for CVEs, or run omv skills — and before claiming a finding is confirmed, ready to submit, or…

原文语言：英语